EUVD-2026-90836
GHSA-h8hq-r6h2-qpc4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running WPFunnels ≤3.13.1
-
DeliveryObserve object reference parameters in requests
-
ExploitEnumerate/substitute object IDs
-
ExecutionAccess or modify unauthorized funnel objects
-
ImpactDisclose or tamper with limited data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of a WordPress site running the WPFunnels plugin at version 3.13.1 or earlier (PR:N/UI:N/AC:L). The only prerequisite is that the vulnerable plugin is installed and its object-referencing endpoints are reachable; the attacker must be able to supply or iterate the direct object identifiers. Impact is inherently limited to the specific funnel-related objects exposed by the IDOR (low confidentiality and low integrity), not full site compromise. |
| Impact | Moderate, pragmatic risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, 6.5) describes a network-reachable, low-complexity flaw requiring no authentication or user interaction, which maximizes exploitability - any visitor can reach the vulnerable endpoint. However, impact is explicitly bounded to LOW confidentiality and LOW integrity with no availability effect, consistent with an IDOR (CWE-639) that lets an attacker read or tamper with specific funnel-related objects by guessing/iterating object references rather than achieving full compromise. No EPSS score, no CISA KEV listing, and no public PoC are provided, so there is no evidence of active or automated exploitation at this time; this is a real-but-not-urgent priority - a patch-on-schedule item, not an emergency. Note one data-consistency issue: the vendor tag labels this 'Authentication Bypass,' but the CWE-639 classification and description describe an authorization/object-reference flaw, not an authentication-control bypass - do not treat it as credential bypass. No conflict exists between the CVSS vector and the description; both indicate unauthenticated network access. |
| Exploit ScenarioDerived | An unauthenticated attacker observes how WPFunnels references funnel-related objects (e.g., sequential or guessable IDs in requests) on a WordPress site running the plugin, then iterates or substitutes those identifiers to access or modify objects belonging to other users or funnels without any ownership check. Because no authentication or user interaction is required (PR:N/UI:N), this can be scripted against any reachable installation. No public proof-of-concept is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
Unauthenticated attackers can exploit an insecure direct object reference (IDOR) in WPFunnels 3.13.1 and earlier to read or alter funnel-related objects they do not own. The flaw has a CVSS base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), reflecting remote, unauthenticated exploitation with low confidentiality and integrity impact but no availability impact. No public exploit code has been identified at time of analysis, and CISA KEV does not list this CVE; the risk is assessed as moderate, pragmatic risk, with impact limited to the exposed funnel objects.
RemediationAI
No vendor-released patch identified in the provided data; users should monitor the Patchstack advisory for WPFunnels and apply the latest fixed release as soon as it becomes available, upgrading beyond version 3.13.1. If an immediate update is not possible, consider disabling the WPFunnels plugin until a patch is applied, though this removes funnel functionality. As a compensating control, restrict access to WPFunnels endpoints using a web application firewall or server-level rules that block unauthenticated requests to object-referencing paths; this may cause false positives and requires tuning. Because exploitation is unauthenticated and requires no user interaction, logging and monitoring for anomalous access to funnel IDs can help detect attempts, but does not prevent the flaw.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic IDOR (CWE-639: Authorization Bypass Through User-Controlled Key) in the WordPress plugin WPFunnels. The plugin exposes endpoints that reference funnel-related objects by direct identifiers, and it fails to verify that the requesting user is authorized to access or modify the referenced object. Because the CVSS vector includes PR:N and UI:N, no authentication or user interaction is required-any remote attacker who can reach the endpoint and supply or enumerate object identifiers can exploit it. The CPE cpe:2.3:a:wpfunnels:wpfunnels:*:*:*:*:*:*:*:* confirms the affected product is the WPFunnels plugin itself. The root cause is a missing or inadequate authorization check before performing operations on objects keyed by user-supplied identifiers.
Know when Wpfunnels gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Unauthenticated network IDOR with low complexity and no interaction (AV:N/AC:L/PR:N/UI:N); CWE-639 grants limited read and modify on referenced objects (C:L/I:L), no availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Insecure Direct Object References (IDOR) in WPFunnels <= 3.13.1 versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Arbitrary file upload in the WordPress plugin Creator LMS (by WPFunnels) versions 1.2.21 and earlier lets an authenticat
Unauthenticated PHP Object Injection affects the Mail Mint email-marketing plugin for WordPress (by WPFunnels) in all ve
Unauthenticated log file exposure in WPFunnels WordPress plugin (versions 2.6.0 through <3.13.0) enables any remote visi
Unauthorized WordPress account creation in WPFunnels (versions 3.6.3 through before 3.13.0) allows unauthenticated remot
Unauthenticated email relay abuse in WPFunnels WordPress plugin versions 3.1.0 through 3.12.x allows any remote visitor
Price manipulation in WPFunnels WordPress plugin before 3.13.0 allows unauthenticated attackers to apply a configured or
An Incorrect Privilege Assignment vulnerability exists in WPFunnels Creator LMS plugin (versions up to and including 1.1
Authenticated path traversal in the WordPress Creator LMS plugin (WPFunnels) affects all versions up to and including 1.
Stored or reflected cross-site scripting in WPFunnels Pro WordPress plugin versions 2.9.4 and earlier allows unauthentic
Unauthenticated cross-site scripting in the WPFunnels WordPress plugin at versions 3.13.1 and earlier allows remote atta
Reflected cross-site scripting (XSS) in WPFunnels plugin versions 3.13.1 and earlier allows unauthenticated attackers to
Broken access control in the WPFunnels WordPress plugin (versions <= 3.12.13) permits unauthenticated remote attackers t
Exploit-DB